PAM, IAM, Or Both?

Identity & Access Management (IAM) and Privileged Access Management (PAM) are often misunderstood, having similar features in dealing with users, access, and roles. They also refer to safeguarding data by protecting who has access to systems and what manipulation is allowed to sensitive areas.

Despite these facts, they are different. The role of PAM is to protect users with privileged access to sensitive data such as System Administrators or Developers.

Privileged credentials (also called privileged passwords) are a subset of credentials that provide elevated access and permissions across accounts, applications, and systems. Privileged passwords can be associated with human application, service accounts, and more. Secure Shell Protocol (SSH) keys are one type of privileged credential, used across enterprises, to access servers and open pathways to highly sensitive assets.

Privileged account passwords are often referred to as ‘the keys to the IT kingdom’ as, in the case of superuser passwords, they can provide the authenticated user with almost limitless privileged access rights across an organisation’s most critical systems and data. With so much power inherent of these privileges, they can be an area for abuse by insiders and are highly coveted by hackers. Forrester Research estimates that 80% of security breaches involve privileged credentials.

IAM on the other hand focuses on business users or third parties, controlling the access and experience these users are given within an application or service. Frequently IAM is linked to zero trust measures and strong authentication.

In many cases companies think that by adding an IAM solution it will take care of the privileged users as well. But this is a mistake, as PAM goes far broader in its controls and should be the first authentication measure deployed as PAM solutions take security and compliance a step further, helping IT teams to control privileged users and accounts.

In short, IAM manages identities for common accesses that occur in routine activities, PAM controls access of privileged and active users in critical system environments. 
 
PAM systems define which employees, partners, vendors, and applications have what level of access for specific accounts or data. Implementation of PAM is a mix of software, processes, and enforcement, only those with privileged access can have permission to use the most critical data and assets.

Some key features of a PAM system are:

  • Password vault: management and protection of critical credentials through session monitoring.
  • Usage limit: limiting account usage based on a specific time, or a certain approval extent.
  • Discovery: auto-discovery of privileged credentials that may be on the system without the administrator’s knowledge.
  • Visibility: view of what happens when an access is requested, approved, and performed.
  • Audit: recording of evidence from accesses performed correctly or not.

 Both IAM and PAM are useful to protect your organisation from security theft. To fully protect your business from internal and external threats, both IAM and PAM solutions should be deployed.

By using these tools together, companies can eliminate any unprotected coverage gaps from hackers with a complete security solution that regulates password use, monitors user access activity, and facilitates government regulation compliance. It could even save money on cyber insurance premiums.

Companies must ensure that they closely integrate their IAM and PAM tools, this will help avoid redundant processes for privileged and everyday user accounts. With the strong combination of these systems , companies can have trust in automated provisioning of user accounts which enables swift removal of a user profile when a person leaves, or a compromise is detected.

Additionally, using strong user identity management ensures  faster reporting and auditing across all  user accounts, making any form of investigation much easier.

Identity Access Management (IAM) and Privileged Access Management (PAM) are completely different from each other in terms of working, as well as audience. I always advise that a PAM solution should be the primary implementation, followed by a complementary IAM solution, as the exposure of data is far greater when a privileged user is compromised.

Colin Tankard is Managing Director of Digital Pathways

You Might Also Read:

Is It Time To Consolidate Systems?:


If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« EU Fines Meta $416m
Why We Should Worry About A War On Cybercrime »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

TestFort

TestFort

TestFort QA Lab is a specialized software testing company offering independent quality assurance and software testing services.

SecureNow Insurance Broker

SecureNow Insurance Broker

SecureNow is a commercial insurance broker based in India. Services offered include Cyber Risk insurance.

Minerva Labs

Minerva Labs

Minerva’s patent pending solution keeps malware in a constant sleep state before it can infiltrate your network and cause any damage.

Optimal IdM

Optimal IdM

Optimal IdM is a leading global provider of identity management solutions and services.

Halo Consulting

Halo Consulting

We provide advice on products from all of the major insurance providers including cyber liability insurance.

Sentropi

Sentropi

Sentropi is an online protection solution against charge backs, account takeovers, identity thefts and online scams.

Trusted Knight

Trusted Knight

Trusted Knight is a leading provider of security software solutions focused on defeating newly developed malware and crimeware trojans.

Nouveau

Nouveau

Nouveau Solutions is a specialist IT managed services company with a strategic focus on delivering cloud, infrastructure, compliance, network and security solutions.

Open Connectivity Foundation (OCF)

Open Connectivity Foundation (OCF)

OCF is dedicated to ensuring secure interoperability ensuring secure interoperability of IoT for consumers, businesses and industries.

British Blockchain Association (BBA)

British Blockchain Association (BBA)

British Blockchain Association (BBA) is a not-for-profit organisation that promotes evidence-based adoption of Blockchain and Distributed Ledger Technologies (DLT) across the public and private sector

Kasada

Kasada

Kasada provides bot detection and mitigation for enterprise web applications. Stop the bots before they reach your site and web applications.

Cyber Security Forum Initiative (CSFI)

Cyber Security Forum Initiative (CSFI)

CSFI is a non-profit organization with a mission to provide Cyber Warfare awareness, guidance, and security solutions through collaboration, education, volunteer work, and training.

Atlantic Data Security

Atlantic Data Security

Atlantic Data Security is skilled in the analysis, recommendation, deployment, and management of all critical components of the security infrastructure.

Tozny

Tozny

Tozny offers products with security and privacy in mind that are built on the foundation of end-to-end encryption, and open-source verifiable software.

Axient

Axient

Axient advances defense and civilian missions from aerospace to cyberspace with multi-domain test and analysis, mission engineering and operations, and advanced technologies.

Sayers

Sayers

Sayers is best known for its ability to solve business challenges with IT solutions. Our areas of expertise include cloud, storage, virtualization, security, mobility and networking.